A SOC 2 report is evidence, not a pass
Many teams file a vendor’s SOC 2 report and check the box. That misses what the report actually says. In CBIZ’s benchmark of 193 SOC 1 and SOC 2 reports, the share with exceptions rose “from 51% last year to 54.9% this year,” and qualified opinions rose “from 8% last year to 10.9% this year” (CBIZ). KPMG UK, looking at over 400 assurance reports, found “It is rare to have Type II reports without exceptions” (KPMG).
In other words, the details matter: what was tested, what failed and what the vendor expects you to do yourself. This guide gives you a 10-point checklist for reviewing vendor SOC 2 reports, plus what changed in 2026.
For how the SOC 2 review fits into a full vendor risk assessment, see Vendor Risk Assessment: Questionnaires, Evidence and Scoring.
SOC 2 basics, and what changed in 2026
A SOC 2 examination reports on a service organization’s controls against the AICPA Trust Services Criteria, which cover “Security, Availability, Processing Integrity, Confidentiality, and Privacy” (AICPA-CIMA). The criteria date from 2017; the AICPA revised their points of focus in 2022 “to provide further clarity and guidance” (Baker Tilly).
| Type 1 | Type 2 | |
|---|---|---|
| Covers | Control design “as of a specified date (single point in time)“ | Design and operating effectiveness “throughout a specified period (usually a 6-12 month period)“ |
| Use for vendor risk | Limited: shows controls exist | Stronger: shows controls worked over time |
Source: Wolters Kluwer.
New in 2026: AI in SOC examinations. In September 2026, the AICPA released Technical Q&A Section 9561 on the “Effect of the Service Organization’s Use of AI on SOC 1 and SOC 2 Examinations” (AICPA-CIMA; Deloitte DART). It does not create a “separate SOC examination model or new criteria,” and third-party AI providers fall under the existing carve-out or inclusive approach (Schneider Downs). For reviewers, that means a vendor’s AI model provider may sit outside the report’s scope unless you check.
The 10-point vendor SOC 2 review checklist
- 1. Report type and period. Is it Type 2? Does the period end recently, and does it cover at least 6 months?
- 2. Auditor’s opinion. Unqualified, qualified (look for “Except for” language), adverse or disclaimer? Deloitte’s first question: “Is the report opinion qualified, and what is my impact?” (Deloitte; PYA)
- 3. Scope and system description. Does the described system include the product, data centers and locations that serve you?
- 4. Trust Services Criteria covered. Security is always included. If you rely on uptime or privacy, check that Availability, Confidentiality or Privacy are in scope.
- 5. Subservice organizations. Carve-out or inclusive? Under carve-out, the subservice provider’s controls are excluded, and “Carve-outs can create visibility gaps, especially when sub-vendors perform critical functions” (CRI; Schellman). CBIZ found 96% of benchmarked reports used carve-out.
- 6. CSOCs. List the complementary subservice organization controls the vendor relies on, and decide whether you need those providers’ own reports.
- 7. CUECs. Complementary user entity controls “are listed in the report, but are not tested” (Deloitte). They are your responsibility. Map each one to an owner on your side.
- 8. Test exceptions. Read every exception and the vendor’s response. KPMG found “89% of all exceptions noted on tests of operating effectiveness were manually operated controls” (KPMG), so look closely at manual processes like access reviews.
- 9. Bridge letter. If the period ended months ago, request a bridge letter, “a representation provided by the vendor” covering the gap (PYA). “A long bridge period can lead to increased risks and reduced assurance” (Deloitte).
- 10. AI and new services. Does the vendor use AI providers or features that launched after the period? If so, they are likely outside the report and need separate assurance.
What regulators expect, and how to document your review
For banks, the Interagency Guidance on Third-Party Relationships says an organization “may consider reviewing System and Organization Control (SOC) reports” and should consider “whether the scope and the results of the SOC reports… are relevant to the activity to be performed” (Federal Register). The Federal Reserve issued it as SR 23-4 (Federal Reserve). For New York financial firms, NYDFS’s October 2025 guidance says ongoing assessments “may consider, among other things, security attestations (e.g., SOC2, ISO 27001)” (NYDFS).
The common thread is relevance: examiners want to see that you read the report against your use of the vendor. A short review memo per vendor should record:
| Field | Example |
|---|---|
| Report | SOC 2 Type 2, Jan 1 – Dec 31, 2025, unqualified |
| Scope fit | Covers production platform; excludes EU data center (not used) |
| Exceptions | 2 exceptions in access reviews; vendor remediated in Q1 2026 |
| CUECs | 6 CUECs mapped to internal owners |
| Subservice | Cloud host carved out; host SOC 2 reviewed separately |
| Bridge letter | Received, covers through Sep 30, 2026 |
| Decision | Approved with follow-up on access review remediation |
Scaling SOC 2 reviews with AI
A careful review of one SOC 2 report can take hours. Multiply by hundreds of vendors and annual renewals, and most teams fall behind. AI can do the first pass:
- Extract the opinion, period, scope, subservice organizations, CUECs and exceptions into a structured summary.
- Compare the report’s scope with the service you actually buy.
- Flag exceptions and CUECs that need an internal owner.
- Cite the page for every extracted item, so the analyst can verify in seconds.
The analyst still decides. AI just makes sure nothing in the 80-page report is skipped.
Try a security evidence assessment with one vendor’s SOC 2 report. AskDona maps the report to the requirements you choose and shows the passage behind every finding.
FAQ
What is the most important part of a SOC 2 report to review? Start with the auditor’s opinion and the scope. A qualified opinion or a scope that excludes your service changes how much the rest of the report is worth.
What are CUECs? Complementary user entity controls: controls the vendor expects you to perform. They “are listed in the report, but are not tested” (Deloitte).
Is a SOC 2 report with exceptions a red flag? Not automatically. Exceptions are common: CBIZ found them in 54.9% of benchmarked reports (CBIZ). Judge each exception by the control’s relevance to you and the vendor’s remediation.
What is a bridge letter? A vendor representation covering the gap between the end of the SOC report period and today. It is not audited.
Does SOC 2 cover a vendor’s AI? Only if the AI systems are within the described system. AICPA’s 2026 Technical Q&A applies existing SOC rules to AI rather than creating new criteria (Schneider Downs).
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| AICPA-CIMA: 2017 Trust Services Criteria (2022 points of focus) | Standards body | 2022 | TSC categories |
| AICPA-CIMA: TQA Section 9561 on AI | Standards body | Sep 11, 2026 | AI in SOC exams |
| Deloitte DART: AICPA TQAs on AI | Audit firm | Sep 21, 2026 | AI TQA coverage |
| Schneider Downs: TQA 9561 | Audit firm | Sep 30, 2026 | No new criteria |
| Baker Tilly: Updated SOC 2 guide | Audit firm | Nov 17, 2022 (updated 2025) | 2022 revisions |
| Wolters Kluwer: SOC reports | Publisher | Jan 25, 2022 | Type 1 vs Type 2 |
| Deloitte: Reviewing third-party SOC reports | Audit firm | 2025 | Opinion, CUECs, bridge letters |
| CRI: How to review a SOC report | Audit firm | Mar 20, 2026 | Opinion types, carve-outs |
| PYA: SOC report review guide | Audit firm | Jul 17, 2026 | Qualified opinion, bridge letter |
| Schellman: Carve-out vs inclusive | Audit firm | Jan 10, 2024 | Subservice methods |
| CBIZ: SOC Benchmark Report | Audit firm | 2024 | Exception and qualification rates |
| KPMG UK: SOC reporting benchmarking | Audit firm | Oct 2024 | Type II exceptions, manual controls |
| Federal Register: Interagency Guidance | Regulator | Jun 9, 2023 | SOC report relevance |
| Federal Reserve SR 23-4 | Regulator | Jun 7, 2023 | Fed adoption |
| NYDFS: Third-party guidance | Regulator | Oct 21, 2025 | SOC 2 / ISO 27001 attestations |
Note: KPMG’s benchmark includes UK and international assurance reports, not only US SOC 2.